agent-availability-report
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
generate-availability-report.jsscript executes shell commands viaexecFile. It runsnpm viewto check package versions andnpm installto verify package availability in a temporary directory. It also executes a dynamically generated Node.js script to confirm package resolution. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
nvidia.github.iousing thefetchAPI to verify documentation status. It also downloads packages from the public npm registry during the installation check phase. All external resources are associated with the vendor or well-known services. - [DYNAMIC_EXECUTION]: The script creates a temporary file
resolve-check.mjsat runtime to perform package resolution tests. The content of this script is generated from a hardcoded list of packages and does not incorporate unvalidated external input. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources which could potentially contain malicious instructions.
- Ingestion points: The script fetches content from documentation URLs (e.g.,
https://nvidia.github.io/elements/) and reads output fromnpm viewcommands. - Boundary markers: The script does not apply specific boundary markers or "ignore instructions" prompts when formatting the report for the agent.
- Capability inventory: The skill has the ability to execute shell commands (
npm,node) and perform network requests (fetch). - Sanitization: The script performs basic sanitization by compacting whitespace and truncating long output, and it validates that docs site content contains specific keywords ("nvidia", "elements").
Audit Metadata